US Army soldier 'Kiberphant0m' sentenced to 70 months for Snowflake-linked AT&T and Verizon data theft and extortion
U.S. Army soldier Cameron John Wagenius (alias Kiberphant0m), 22, was sentenced in Seattle to 70 months in federal prison and ordered to pay $294,978 in restitution. He had pleaded guilty to hacking multiple telecommunications companies and stealing call and text metadata for more than 100 million AT&T customers in 2024. Working with co-conspirators, he downloaded data from Snowflake customer environments that had exposed credentials and no MFA, then extorted victims publicly on cybercrime forums. Prosecutors said he made only about $1,500 from selling stolen data, although AT&T had earlier paid a $370,000 Bitcoin ransom to the extortion group. While in custody, Wagenius also violated Bureau of Prisons computer policies by asking other inmates to prompt AI tools for privilege-escalation CVEs and working exploit code.
Detalhes técnicos
- Initial access came from Snowflake customer accounts with exposed credentials and no multi-factor authentication. Snowflake has since mandated MFA on all accounts.
- Stolen data was call and text metadata (source and destination number, timestamp, duration). Kiberphant0m claimed to have breached more than a dozen telecoms worldwide, including Verizon's Push-to-Talk business.
- He re-extorted victims and, after co-conspirator Conor Moucka was arrested, posted what he claimed were AT&T call logs for then President-elect Donald Trump and then Vice President Kamala Harris, plus alleged NSA schematics.
- Prosecutors named Kenneth Schuchman, previously convicted over the Satori botnet, as an assistant in the extortion. Conor Riley Moucka ("Judische") pleaded guilty in August 2026. John Erin Binns, who is also wanted over the 2021 T-Mobile breach, is still facing charges.
- In September 2025, Wagenius used other inmates' email accounts to have AI tools asked for Windows 10 Enterprise privilege-escalation CVEs with working scripts, and for step-by-step exploitation and code for CVE-2023-45208 (a D-Link command injection flaw). He framed the requests as research for a book, which prosecutors described as prompt injection. The government has no evidence he deployed any exploit against BOP systems.
- The investigation involved DCIS, the FBI, Army CID and the U.S. Secret Service. DCIS treated the case as an insider threat because the suspect was an active-duty soldier with a secret clearance.
Remediação
- Enforce MFA on all cloud data platform accounts and rotate credentials that may have been exposed.
- Monitor for abnormal bulk data downloads from cloud storage services.
Linha do tempo
-
US Army soldier 'Kiberphant0m' sentenced to 70 months for Snowflake-linked AT&T and Verizon data theft and extortion
ler a análise desta fonte ocultar
U.S. Army soldier Cameron John Wagenius (alias Kiberphant0m), 22, was sentenced in Seattle to 70 months in federal prison and ordered to pay $294,978 in restitution. He had pleaded guilty to hacking multiple telecommunications companies and stealing call and text metadata for more than 100 million AT&T customers in 2024. Working with co-conspirators, he downloaded data from Snowflake customer environments that had exposed credentials and no MFA, then extorted victims publicly on cybercrime forums. Prosecutors said he made only about $1,500 from selling stolen data, although AT&T had earlier paid a $370,000 Bitcoin ransom to the extortion group. While in custody, Wagenius also violated Bureau of Prisons computer policies by asking other inmates to prompt AI tools for privilege-escalation CVEs and working exploit code.
Technical Details
- Initial access came from Snowflake customer accounts with exposed credentials and no multi-factor authentication. Snowflake has since mandated MFA on all accounts.
- Stolen data was call and text metadata (source and destination number, timestamp, duration). Kiberphant0m claimed to have breached more than a dozen telecoms worldwide, including Verizon's Push-to-Talk business.
- He re-extorted victims and, after co-conspirator Conor Moucka was arrested, posted what he claimed were AT&T call logs for then President-elect Donald Trump and then Vice President Kamala Harris, plus alleged NSA schematics.
- Prosecutors named Kenneth Schuchman, previously convicted over the Satori botnet, as an assistant in the extortion. Conor Riley Moucka ("Judische") pleaded guilty in August 2026. John Erin Binns, who is also wanted over the 2021 T-Mobile breach, is still facing charges.
- In September 2025, Wagenius used other inmates' email accounts to have AI tools asked for Windows 10 Enterprise privilege-escalation CVEs with working scripts, and for step-by-step exploitation and code for CVE-2023-45208 (a D-Link command injection flaw). He framed the requests as research for a book, which prosecutors described as prompt injection. The government has no evidence he deployed any exploit against BOP systems.
- The investigation involved DCIS, the FBI, Army CID and the U.S. Secret Service. DCIS treated the case as an insider threat because the suspect was an active-duty soldier with a secret clearance.
Remediation
- Enforce MFA on all cloud data platform accounts and rotate credentials that may have been exposed.
- Monitor for abnormal bulk data downloads from cloud storage services.